CVE Vulnerability Catalog

prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling. Attackers can write arbitrary files to the client system by crafting malicious ZIP archives with unsanitized filenames containing path traversal sequences (../).

Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire within a reasonable amount of time. This vulnerability may grant unauthorized access to production storage containers.

Hirschmann Industrial HiVision versions 08.1.03 prior to 08.1.04 and 08.2.00 contain a vulnerability in the execution of user-configured external applications. A local attacker can place a malicious binary in the execution path, leading to arbitrary code execution with elevated privileges.

Hirschmann HiOS devices before versions 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device by sending specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size.

Vulnerability in Cloudreve (self-hosted file management and sharing system) before version 4.13.0. The application uses a weak PRNG (math/rand) seeded with admin account creation time. An attacker can recover the secret_key and forge JWT tokens, leading to admin account takeover.

Budibase to otwartoźródłowa platforma low-code. W wersjach przed 3.32.5, Paleta Komend Budibase renderuje nazwy encji (tabele, widoki, zapytania, automatyzacje) bez sanitizacji, co pozwala na wstrzyknięcie ładunku HTML przez uwierzytelnionego użytkownika z dostępem do Budowniczego.

Budibase before version 3.33.4 contains a path traversal vulnerability in the plugin file upload endpoint (POST /api/plugin/upload). An attacker with Global Builder privileges can upload a file with a filename containing ../, allowing deletion of arbitrary directories and writing arbitrary files to the filesystem.

In NFSD (Linux kernel), a missing reference to the network namespace (struct net) when opening /proc/fs/nfs/exports. After the namespace is torn down (e.g., container removal), reading from the open file descriptor leads to use-after-free in the export cache.

A buffer overflow vulnerability in the hid_hw_request function in the Linux kernel's HID BPF. The return value can be arbitrarily large because it comes from dispatch_hid_bpf_raw_requests(), which calls struct_ops without guarantees. This could lead to a buffer overflow.

In the Linux kernel's nvdimm/bus subsystem, there is a potential use-after-free vulnerability during asynchronous initialization. If device_add() fails, accessing freed memory may occur.

A vulnerability has been identified in the Linux kernel regarding incorrect pte restoration for lazyfree folios. The issue involved potentially setting an entire batch of anonymous folios as writable during unmapping, which has been fixed by respecting the writable bit during batching.

In the Linux kernel, a vulnerability in move_pages_huge_pmd() handling UFFDIO_MOVE for THP and huge zero pages was found. For zero pages, src_folio is set to NULL, causing folio_mk_pmd(NULL) to create a PMD pointing to non-existent physical memory (SPARSEMEM_VMEMMAP) or a NULL dereference (other models). Additionally, PMD reconstruction in the zero branch drops pmd_special(), allowing vm_normal_page_pmd() to treat the moved zero page as normal and corrupt its refcount.

A use-after-free vulnerability was found in the Linux kernel's MACB (Cadence) driver. The PTP clock is registered on interface open and destroyed on close, but can be accessed via ethtool get_ts_info while the interface is present, leading to a read-after-free.

In the Linux kernel's bnxt_en driver, an out-of-bounds access vulnerability exists in the DBG_BUF_PRODUCER async event handler. The firmware-supplied 'type' field is used as an array index without bounds validation, potentially leading to out-of-bounds kernel memory access.

In the Linux kernel, the Bluetooth L2CAP stack has an out-of-bounds read vulnerability in l2cap_information_rsp() due to insufficient payload length validation. This can lead to reading adjacent kernel memory.

In the Linux kernel's SMB client, a bug was fixed where the SMB session from the first mount was reused for subsequent mounts with different usernames when using Kerberos. Now the client correctly matches the username option in match_session() even for Kerberos.

In the Linux kernel's SPI driver, a use-after-free vulnerability exists during controller registration. If per-CPU statistics allocation fails, deregistration from the driver core is not performed, leading to use-after-free and uncontrolled register accesses.

Immich before version 2.6.0 has a credential disclosure vulnerability when authenticating to a shared album. The album password is transmitted in URL query parameters in a GET request to /api/shared-links/me, exposing it in browser history, proxy and server logs, and referrer headers.

Budibase is an open-source low-code platform. Prior to version 3.33.4, the bash automation step executes user-provided commands using execSync without proper sanitization or validation. User input is processed through processStringSync which allows template interpolation, potentially allowing arbitrary command execution.

In the Linux kernel DRM/XE driver, GGTT MMIO access protection relied on hotplug (drm_dev_enter), which failed on driver load failure. An open-coded flag protected by the GGTT lock was added to disable MMIO access during teardown.